Merge remote-tracking branch 'origin/fix/issue-1254' into fix/issue-1254

Author: nedtwigg

dor-tools-builtin/test/markdown-format.test.mjs

@@ -52,6 +52,7 @@ for (const source of [
   '<span title="<literal>">safe</span>\n',
   'Use \\<your relay> and &lt;https://example.com&gt;.\n',
   '\\<script>alert(1)\\</script>\n',
+  'Write \\&#x3C; and \\&#x3E; literally, but \\\\&lt;.\n',
   'A \\[label] **bold** and \\[label]\\(url).\n',
 ]) {
   test(`retains semantics: ${JSON.stringify(source)}`, () => {

dor-tools-builtin/viewer/markdown-format.ts

@@ -32,7 +32,7 @@ export function markdownFormat(markdown: string): Options {
       },
       text(node, _parent, state, info) {
         const safe = state.safe(node.value, { ...info, encode: ['<', '>'] })
-          .replace(/&#x3C;/gi, '&lt;').replace(/&#x3E;/gi, '&gt;');
+          .replace(/\\[^]|&#x3([CE]);/g, (match, hex: string | undefined) => hex ? (hex === 'C' ? '&lt;' : '&gt;') : match);
         // Restore only simple, complete labels. Keep escapes inside link labels,
         // list items (task syntax), and documents with reference definitions.
         if (references || state.stack.some(kind => ['label', 'reference', 'listItem'].includes(kind))) return safe;